Documentation
¶
Overview ¶
Package authmint signs JWTs and serves a matching JWKS document.
Used by:
- cmd/control-plane — long-running issuer of per-tenant access tokens
- cmd/issue-test-token — one-shot dev helper that exercises the auth middleware without spinning up the full control plane
Both binaries need to (a) produce signed JWTs and (b) expose the public half of the signing key as a JWKS so tenant backends can verify those tokens. The signer hides the cryptographic plumbing behind a tiny API.
For now the signing key is generated fresh on every call to NewSigner — fine for dev, but production deployments will need a persistent key (loaded from disk/secret manager) and key rotation. Both come in 2C.2.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Signer ¶
type Signer struct {
// contains filtered or unexported fields
}
Signer holds an RSA signing key and the kid it advertises in JWKS docs and JWT headers. Use NewSigner to construct.
func NewSigner ¶
NewSigner generates a fresh 2048-bit RSA key and assigns a stable kid that the signer will use in both JWT headers and the JWKS document.
func (*Signer) JWKS ¶
JWKS returns a JWKS document (RFC 7517) containing the signer's public key. Tenant backends point their APEX_JWKS_URL at an HTTP endpoint that serves these bytes.
func (*Signer) JWKSHandler ¶
func (s *Signer) JWKSHandler() http.HandlerFunc
JWKSHandler returns an http.HandlerFunc that serves the JWKS document. Convenience for control plane HTTP servers and dev helpers.
func (*Signer) Keyfunc ¶
Keyfunc returns a jwt.Keyfunc that resolves to this signer's public key. Useful for verifying tokens that this same signer issued without taking a JWKS round-trip (e.g. the control plane verifying its own user/state tokens). Tenant backends use a JWKS-cached keyfunc instead because they don't have direct access to the signer.
Source Files